1

I'm trying to enable ufw in remote ubuntu server. This server has two LXC container running. One container has nginx server running and I have hosted web application, right now every thing is working fine. I did port forwarding to access webapp of container from local system. I wanted to allow only 80 and 22 to be accessible through firewall, remaining all won't be allowed. These are the rules I did

# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22                         ALLOW IN    Anywhere
80                         DENY IN     Anywhere
22 (v6)                    ALLOW IN    Anywhere (v6)
80 (v6)                    DENY IN     Anywhere (v6)

after I enable the firewall with port 80 DENY I still be able to access the webapp of the container.

# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:10.0.3.2:80

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.0.3.0/24         !10.0.3.0/24  

Again to check whether firewall is working or not I tried use scp, scp will use port 21. As my firewall in ubuntu server is enable I shouldn't allow to copy file to server but I can able to copy files. check this

# scp /home/Attributes123.csv root@myserver:/home/ 
root@myserver's password:  
Attributes123.csv  100%    0    0.0KB/s   00:00

So my firewall setup is not working. any idea why it is not working? I did reboot after enable firewall but no luck.

3
  • 1
    scp by default use port 22. Also you don't need 80 DENY IN Anywhere because is Default: deny (incoming)
    – 2707974
    May 15, 2014 at 12:14
  • Also your Chain INPUT (policy ACCEPT) must be DROP. Something is wrong.
    – 2707974
    May 15, 2014 at 12:23
  • @2707974: If I do sudo iptables -t nat -L, then all of the default policies are ACCEPT, whereas if I do sudo iptables -L, the INPUT chain default is DROP. May 15, 2014 at 13:06

0

You must log in to answer this question.

Browse other questions tagged .